@GossiTheDog Are you going to laugh at me if I ask what IAM system you were running?
Like, afaik MIM Sync is free with a Windows license now.
And... that's what it does. Hook up HR on one side, hook up AD on the other, throw some rules in and push "go".
You find out pretty quickly when people have the wrong name or no contract in HR because it gets sycned everywhere.
if HR.ActiveEmployee == False
AD.Disable()
Any basic Identity & Access system will do